AI Security Operations Lead

ZipStaff Inc.; Center Square (PA); Remote; USD 180,000 - 240,000; Full time

Job summary

ZipStaff Inc. seeks an AI SecOps & Detection Lead to build and operate the AI security lifecycle for a healthcare analytics and payment integrity organization.

You will integrate AI findings from Wiz and AIM into existing SOC workflows and lead shadow-AI discovery and incident response playbooks. This senior hands-on role requires 10+ years in enterprise SecOps, with experience in SIEM/SOAR, asset discovery, and hybrid environments.

Qualifications

• 10+ years of hands-on enterprise SecOps, detection engineering or IR.
• Deep experience with SIEM/SOAR, alert triage and IR in complex environments.
• Operationalize asset discovery and telemetry mapping across cloud and on-prem.
• Knowledge of AI-specific threats and turning them into detections.
• Experience embedding Wiz/AIM findings into a unified SOC workflow.

Responsibilities

• Integrate AI-specific alerts from Wiz, AIM into SOC/SIEM/SOAR pipelines.
• Build and operate shadow AI discovery using telemetry, not self-reporting.
• Create incident response playbooks for AI incidents and lead tabletop exercises.
• Translate discovery findings into remediation requests and tighter controls.
• Maintain AI tool inventory, risk assessments, and audit-ready docs.
• Quantify detection efficacy and risk-posture trends for leadership.
• Collaborate with SOC, engineering, compliance and security leadership.

Skills

SecOps experience

IR & incident response

SIEM / SOAR

Cloud & on-prem telemetry

AI threat awareness

Tabletop & playbooks

Remote work in US time zones

Tools

Wiz

AIM

SOC tooling

Job description

Job Title: AI SecOps & Detection Lead - Discovery, Response & Prevention

Location: Remote (U.S.) | Blue Bell, PA area team

Employment Type: Contract (W2 through ZipStaff - No C2C or 1099)

About the Opportunity

ZipStaff is seeking an AI SecOps & Detection Lead to build and operate the AI security lifecycle for a leading healthcare analytics and payment-integrity organization.

This role answers three questions: do we have full visibility into AI in use, can we respond when something goes wrong, and are we feeding lessons back into prevention. You will integrate AI findings from tools such as Wiz and AIM into existing SOC workflows - not a separate queue. Shadow-AI discovery, AI IR playbooks, and auditable governance are core. This is a senior hands-on SecOps lead, not a policy-only GRC seat.

What You’ll Do:

• Integrate AI-specific alerts and findings from Wiz, AIM, and similar tools into existing SOC / SIEM / SOAR pipelines.
• Build and operate shadow AI discovery using telemetry - not self-reporting.
• Create AI-specific incident response playbooks and lead tabletop exercises.
• Translate discovery findings and incident patterns into remediation requests and tighter controls.
• Maintain the AI tool inventory, risk assessments, and audit-ready documentation.
• Quantify detection efficacy, coverage gaps, and risk-posture trends for leadership.
• Partner with SOC, engineering, compliance, and security leadership.

Required Qualifications:

• 10+ years of hands-on enterprise SecOps / detection engineering / incident response.
• Deep experience with SIEM/SOAR, detection logic, alert triage, and IR in complex enterprise environments.
• Proven ability to operationalize asset discovery and telemetry mapping across cloud and on-prem.
• Working knowledge of AI-specific threats: prompt injection, model poisoning, agent credential abuse, data exfiltration - and how to turn them into detections.
• Experience embedding specialized findings (Wiz, AIM, or equivalent) into a unified SOC workflow.
• Metrics-driven risk management (detection efficacy, coverage gaps, executive reporting).
• Experience maintaining visibility across hybrid (cloud + on-prem) environments.
• Ability to work remote in U.S. time zones aligned to the Blue Bell, PA team.
• Must be legally authorized to work in the United States without sponsorship now or in the future.

Preferred Qualifications:

• Healthcare, payment integrity, or other regulated-industry SecOps.
• Prior ownership of an AI / shadow-IT discovery program.
• Tabletop exercise design for emerging-technology incidents.
• Familiarity with cloud security platforms beyond Wiz (CSPM / CNAPP).